CVSS: 6.8EPSS: 1%CPEs: 11EXPL: 2CVE-2009-1912 – webSPELL 4.2.0e - 'page' Blind SQL Injection
https://notcve.org/view.php?id=CVE-2009-1912
Directory traversal vulnerability in src/func/language.php in webSPELL 4.2.0e and earlier allows remote attackers to include and execute arbitrary local .php files via a .. (dot dot) in a language cookie. NOTE: this can be leveraged for SQL injection by including awards.php. Vulnerabilidad de salto de directorio en src/func/language.php en webSPELL v4.2.0e y anteriores, permite a los atacantes remotos incluir y ejecutar arbitrariamente archivos locales .php a través de ..(punto punto) en una cookie de lenguaje. • https://www.exploit-db.com/exploits/8622 http://osvdb.org/54295 http://secunia.com/advisories/35016 http://www.osvdb.org/54296 http://www.securityfocus.com/bid/34862 http://www.webspell.org http://www.webspell.org/index.php?site=files&file=30 http://www.webspell.org/index.php?site=news_comments&newsID=130 https://exchange.xforce.ibmcloud.com/vulnerabilities/50395 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 2CVE-2009-1408 – webSPELL 4.2.0c - Bypass BBCode Cross-Site Scripting Cookie Stealing
https://notcve.org/view.php?id=CVE-2009-1408
Cross-site scripting (XSS) vulnerability in webSPELL 4.2.0c allows remote attackers to inject arbitrary web script or HTML allows remote attackers to inject arbitrary web script or HTML via Javascript events such as onmouseover in nested BBcode tags, as demonstrated using (1) email, (2) img, and (3) url tags. Una vunerabildad de ejecución de secuencias de comandos en sitios cruzados(XSS) en webSPELL v4.2.0c permite a atacantes remotos inyectar HTML o scripts web arbitrarios a través de eventos Javascript onmouseover en etiquetas BBcode anidadas, como se ha demostrado usando las etiquetas (1) email, (2) img, y (3) url. • https://www.exploit-db.com/exploits/8453 http://osvdb.org/53782 http://secunia.com/advisories/34764 http://www.securityfocus.com/archive/1/502732/100/0/threaded http://www.securityfocus.com/bid/34595 http://www.webspell.org/index.php?site=files&file=25 http://www.webspell.org/index.php?site=news_comments&newsID=126&lang=uk https://exchange.xforce.ibmcloud.com/vulnerabilities/49937 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •